Accounts

Consuela Cloud supports multiple authentication methods, from email and password to enterprise SSO. This page covers every method, how to configure each one, and how sessions and credentials are managed.

Email and password

Signup is a two-step process. First, enter your email address. Consuela checks whether SSO is configured for your domain at this stage — if it is, you are redirected to your identity provider instead of continuing with a password.

If no SSO is configured, the second step collects your name and a password. Passwords must meet all of the following requirements:

A verification email is sent after signup. You must verify your address before you can use the account. If the email does not arrive, request a new one from the verification prompt — each new token invalidates the previous one.

Login

Login also begins with your email address. Consuela runs SSO discovery on every login attempt: if your domain has SSO configured, you are redirected to the identity provider regardless of whether a password exists on the account.

If no SSO applies, you proceed to the password step. After too many consecutive failed attempts the account is temporarily locked. The error response includes a retryAfterSeconds field indicating how long to wait before trying again.

Password reset

From the login screen, select the password-reset link and enter the email address on the account. A reset token is sent by email. Following that link opens a form to set a new password, subject to the same requirements listed above.

MFA

Two-factor authentication adds a TOTP (time-based one-time password) step to login. It works with any authenticator app that supports the TOTP standard — Google Authenticator, 1Password, Authy, and others.

Setup

Enable MFA from your account security settings. The server returns a shared secret and an otpauth:// URI, which your authenticator app can scan as a QR code or accept as a manual entry. After adding it to the app, enter the current six-digit code to verify the setup.

On successful verification, the server returns a set of backup codes. Each code is 24 characters long — five groups of four hexadecimal characters joined by hyphens (e.g. a1b2-c3d4-e5f6-7890-abcd). These codes are displayed exactly once. Store them in a safe place; they are the only way to access the account if the authenticator app is lost.

Backup code regeneration

If backup codes are lost or used up, you can regenerate a new set from the security settings. This action requires sudo mode — you will be prompted to re-enter your password before new codes are issued. Regeneration invalidates all previous backup codes.

Disabling MFA

Disabling two-factor authentication requires your current password. Once disabled, the TOTP secret and all backup codes are deleted.

Passkeys

Passkeys use the WebAuthn standard to authenticate with Touch ID, Windows Hello, or a hardware security key. No password is needed — the device performs the cryptographic ceremony directly.

Registering a passkey

Add a passkey from your account security settings. Registration is sudo-guarded, so you will confirm your identity before proceeding. The passkey is automatically labeled with the device it was created on — you can rename it later if the default label is not descriptive enough.

Logging in with a passkey

On the login screen, select the passkey option. The browser initiates a WebAuthn ceremony — no email or password is entered. The authenticator on your device (fingerprint reader, face recognition, or security key) completes the login.

Managing passkeys

Your security settings list all registered passkeys with their device name and the date each was last used (lastUsedAt). You can delete any passkey from this list. If a device is lost, remove its passkey promptly so it cannot be used to authenticate.

SSO

Enterprise single sign-on lets an organization manage authentication through its own identity provider. Consuela supports both SAML and OIDC. SSO is configured at the organization level by an admin.

SAML

To configure SAML, an admin provides the following from the identity provider:

Consuela provides two values to enter on the identity provider side:

OIDC

To configure OIDC, an admin provides the following:

Consuela provides a Redirect URI to register with the identity provider. After configuration, users whose email domain matches the organization are redirected to the OIDC provider at login.

Social login

Consuela supports sign-in with Google and Microsoft via OAuth. When enabled for a deployment, the corresponding buttons appear on the login and signup screens. Selecting one delegates authentication to the chosen provider — no Consuela password is set or required.

Which social providers are available depends on the deployment configuration. Not every instance displays both options.

Sessions

Active sessions are listed in your account security settings. Each entry shows the device description, the time it was last active, and the authentication method used to create it.

Remote sign-out

You can revoke any individual session from the list. This immediately invalidates that session — the next request from that device will require a fresh login. Use this if a device is lost or if you see a session you do not recognize.

Sudo mode

Certain sensitive actions — registering a passkey, regenerating backup codes — require elevated access. Rather than signing out and back in, Consuela uses sudo mode: you re-enter your password to temporarily elevate the current session. Sudo mode expires after a short window, after which another confirmation is needed for the next sensitive action.